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Abstract 

For the Tardos traitor tracing scheme, we show that by combining the symbol-symmetric accusation 
function of Skoric et al. with the improved analysis of Blayer and Tassa we get further improvements. 
£> Our construction gives codes that are up to 4 times shorter than Blayer and Tassa's, and up to 2 times 

shorter than the codes from Skoric et al. Asymptotically, we achieve the theoretical optimal codelength 
for Tardos' distribution function and the symmetric score function. For large coalitions, our codelengths 
are asymptotically about 4.93% of Tardos' original codelengths, which also improves upon results from 
Nuida et al. 
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Watermarking digital content allows distributors of copyrighted digital data to embed so-called fingerprints 
into their data in such a way that each copy of the data can be uniquely identified. These watermarks are 
made in a robust way, so that users cannot change or remove them from the content. If a copy of the 
data is then illegally distributed to unauthorized users and intercepted by the distributor, he can extract the 
fingerprint from the copy and find the person whose fingerprinted data was distributed. Actions can then 
be taken against this user, to prevent further illegal distribution. 

To be able to trace the watermarked data back to the user, we need that the embedded fingerprints 
for each user are different. However, by comparing their differently watermarked copies of the content, 
multiple malicious users can form a coalition and detect differences in their content. Assuming that besides 
the watermarks all copies are the same, this allows coalitions to detect part of the watermark. By editing 
this data, they can then create a forged copy, which contains the same digital content as their original copies, 
but has a forged fingerprint that cannot be traced back to them directly. Under the marking assumption, 
which says that colluders can only detect and edit fingerprint positions if their fingerprints do not all match 
on that position, there are ways to construct fingerprinting schemes such that any forged copy can be traced 
back to at least one of the colluders. This involves finding a construction for fingerprints for each of the 
5_i ■ users, and finding a way to trace back forged copies to guilty users. 

a i 

1.1 Model 

Let U = {!,..., n} denote the set of the n users that received watermarked content. Here a user corresponds 
to one watermarked copy of the content, so a person who possesses several differently watermarked copies 
of the data is assumed to control multiple users. For each user j the distributor generates a fingerprint (also 
called a codeword), which is usually denoted by xj. This codeword is a vector of length I (the codelength) 
of symbols from an alphabet Q of size q. The case q = 2 corresponds to the binary alphabet, which is 
usually taken as Q — {0, 1}. All fingerprints together form the fingerprinting code c € = {jfi, . . . ,x„}. A 
common way of representing this code is by putting all codewords as rows in a matrix X according to 
Xji — \ x j)i- 
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After assigning codewords to users and distributing the watermarked copies, a subset C C U of c users 
(called colluders or pirates) may form a coalition to create a forged copy. Using some pirate strategy p, a 
function Q exc — > Q^, they construct a forged copy, which has some unknown distorted fingerprint p (X) — y 
called the forgery. For the pirate strategy p, we assume that the marking assumption holds, i.e. if for all 
j E C the pirates have (xj)i = CO for some position i and symbol co E Q, then the coalition is forced to 
output y, = CO. On other positions, we assume that colluders are free to choose any of the symbols from the 
alphabet. 

Finally, after the coalition has created a forged copy, we assume the distributor intercepts it and extracts 
the forgery y from the data. He then runs some tracing algorithm a on the forgery, to get a subset a(y) C U 
of users that are accused. The accusation is said to be successful if no innocent users are accused (i.e. 
c(y) Q C) and at least one guilty user is accused (i.e. a (y) n C 7^ 0). 

In the setting of probabilistic schemes, the code X and the tracing algorithm a may depend on some 
random variables. The events of not accusing any innocent users (soundness) and accusing at least one 
guilty user (completeness) then also depend on these random variables. Then, instead of demanding that 
a fingerprinting scheme is always sound and complete, we may demand that the probability of failure is 
bounded by some small value e, where the probability is taken over these random variables. This leads to 
the following definitions of E\ -soundness and £2-completeness. 

Definition 1 (Soundness and completeness). Let C CU be a coalition of size at most c, and let p be some 
pirate strategy employed by this coalition. Then a traitor tracing scheme (X, a) is called £\ -sound if 

P[a(p(X))%C]<£ x . 

Similarly, a fingerprinting scheme is called £2-complete if 

P[a(p(X))nC = @] <£ 2 . 

As we will see later, £1 jn and £2 are closely related in the Tardos fingerprinting scheme. Therefore it is 
convenient to introduce the notation 77 = log(£2)/log(£i/«) such that £2 = (ei/n)* 1 , which describes how 
big £2 is, compared to £\/n. Also, we sometimes simply say a scheme is secure, to denote that it is sound 
and complete for certain (implicit) parameters £1 and £2. 

1.2 Related work 

In (8), Tardos investigated probabilistic binary fingerprinting schemes where small margins of error are 
allowed. He proved that a codelength of £ = Q.(c 2 ln(n / £1)) is necessary to achieve soundness and com- 
pleteness, while in the same paper he also gave a construction with a codelength of i = 100c 2 ln(n/£i). 
This construction is often referred to as the Tardos scheme. In [ 1 , 3 1 the lower bound on the codelength 
was further tightened, to show that one needs I > 21n(2)c 2 ln(«/£i) for sufficiently large c and q = 2, to 
achieve soundness and completeness. 

Since the scheme of Tardos had a constant 100 in front of the c 2 ln(n/£i) in the codelength, many papers 
focused on constructing a scheme with the same order codelength, but with a smaller constant. For example, 
using a discrete distribution function in the Tardos scheme, Nuida et al. showed in [5 ] that one can achieve 
codelengths of £ < 5c 2 ln(«/fii) in some cases with small c, while for large c they achieved an asymptotic 
codelength of £ w 5.35c 2 ln(n/£i). Using a different approach, Amiri and Tardos showed in [ 1 1 that with 
a computation-heavy construction, one can approach the theoretical lower bound of £ = 21n(2)c 2 ln(n/£i ) 
for large c. 

In this paper we will focus on the binary Tardos scheme with the arcsine distribution function from [ 8 1, 
which was introduced in |8| and further analyzed and improved in e.g. (2l|5H3. We will focus on two 
improvements in particular. In [2], Blayer and Tassa made the proofs of [8 1 tighter by introducing several 
auxiliary variables which were to be optimized later, instead of fixing them in advance. In that paper the 
construction of the Tardos scheme essentially remained the same, but it was shown that a codelength of 
£ = 85c 2 ln(n/£i) is also sufficient to prove soundness and completeness. In |6|, Skoric et al. did change 
the scheme, by making the score function of the Tardos scheme symbol-symmetric. This also lead to 
shorter codelengths, giving asymptotic codelengths of £ = ijt 1 + o(l))c 2 ln(n/£i) sa 9.87c 2 ln(n/£i) for 



large c, while maintaining soundness and completeness. Furthermore assuming that the scores of innocent 
users and the joint coalition score are normally distributed, Skoric et al. showed in [6, Section 6] that an 
asymptotic codelength of £ — (-^ +o(l))c 2 ln(n/ei) is then both sufficient and necessary. Since by the 
Central Limit Theorem these scores will in fact converge to normal distributions for asymptotically large 
c, this also provides a lower bound on the codelength, when using the arcsine distribution function and the 
symmetric score function. 

1.3 Contributions and outline 

Combining the symbol-symmetric score function from Skoric et al. with Blayer and Tassa's sharp anal- 
ysis, we will prove £\ -soundness and £2-completeness for all c > 2 and r\ < 1 with a codelength of 

1 — 23.79c 2 ln(n/ei). This improves upon the codelength from Blayer and Tassa by a factor more than 
3.5, and it improves upon the original Tardos scheme by a factor of more than 4. Furthermore, for bigger 
c and smaller 77 the constant in front of the c 2 \n{n/e\) in i further decreases, easily leading to a factor 10 
improvement over the original Tardos scheme and a factor slightly less than 4 improvement over the Blayer 
and Tassa analysis. 

Similar to work of Skoric et al., we also look at the asymptotics of our scheme, and show that for 
large c, we can prove soundness and completeness for a codelength of I — (^- + 0(c~ l > 3 ))c 2 ln(n / e\) sa 
4.93c 2 ln(n/ei ). This improves upon the asymptotic results from Skoric et al. by a factor 2, and we achieve 
the asymptotic optimal codelength which Skoric et al. proved to be sufficient and necessary under the added 
assumption that the distributions of scores are normal distributions. We therefore close the gap of a factor 

2 between the best known provably secure codelength and the asymptotic optimal codelength, for Tardos' 
original arcsine distribution function and the symmetric score function. These results also improve upon 
the asymptotic codelengths from Nuida et al., who used different discrete distribution functions, by more 
than 7%. 

The paper is organized as follows. In Section|2]we first give the construction of the (symmetric) Tardos 
scheme, and compare our results with earlier results from literature. In Sections[3]and|4]we then prove that 
the soundness and completeness properties hold under our assumptions on the parameters. In Section [5] 
we then give results similar to those in [2, Section 2.4.5] on how to find the optimal set of parameters that 
satisfies the conditions for our proof method to work, and minimizes the codelength. There we also give 
such minimal codelengths, for several values of c and r\. Finally in Section [6] we prove the results stated 
above for asymptotically large c, and show that the optimal rate of convergence is of order 0(c~ l < 3 ). 

This paper is mainly based on results from the first author's Master's thesis |4|. 

2 Construction and results 

First we present the construction of the Tardos traitor tracing scheme, as in [2], where we use auxiliary 
variables d(,d z ,dg for the codelength £, accusation offset Z and cutoff parameter 8 respectively. The only 
difference between our construction and that of Blayer and Tassa is in the score function we use. While 
Blayer and Tassa used the asymmetric score function from Tardos' original scheme, we use the symbol- 
symmetric score function from Skoric et al. 

2.1 The Tardos traitor tracing scheme 

Let n > c > 2 be positive integers, and let E\ , £% G (0, 1) be the desired upper bounds for the soundness and 
completeness error probabilities respectively. Let us write k = ln(n/ei) so that e = E\/n. Let d{,d z ,ds 
be positive constants, with dg > 1. Then the symmetric Tardos fingerprinting scheme works as follows. 

1. Initialization 

(a) Take the codelength as I — d^c 2 k. \}\ 



1 Note that £ may not be integral, while the codelength of a code of course has to be integral. See Appendix fAlf or a short note on 
how to solve this minor problem in our construction. 



(b) Take the accusation offset parameter as Z = d z ck. 

(c) Take the cutoff parameter as 5 — l/(dgc), and compute 5' = arcsin(v5) such that < 5' < 

7T/4. 

(d) For each fingerprint position 1 < i < I, select pi £ [5,1 — 5] independently from the distribution 
defined by the following CDF F(p) and PDF /(/?): 

2arcsin( v /p) — 25' 1 

F (P> = ~ /;> > f\P) = -, ASn i ,, =v C 1 ) 

n-4d' (n-48')y/p(\-p) 

The function f(p) is biased towards 5 and 1—5 and symmetric around 1/2. 

2. Codeword generation 

(a) For each position 1 < i < £ and for each user 1 < j < n, select the fth entry of the codeword of 
user j according to P[Xjj = 1] = pi and P\Xji = 0] = 1 — pi. 

3. Accusation 

(a) For each position 1 < i < I and for each user 1 < jf < n, calculate the score Sji according to: 



'+ V(l-Pi)/Pi ifX J{ = l, yi = l, 

s ... - VPi/d-Pi) ifX // = 0,y, = l I 

" " " V '(1 ~Pi) I Pi XX fl - l,y t = 0, 

+ y/Pi/d~Pi) if^«' = 0,B = 0. 

(b) For each user 1 < j < n, calculate the total accusation sum Sj = YJj=i Sji- User j is accused if 
and only if Sj > Z. 



Under certain conditions on the parameters d{,d z ,ds, which are specified in Subsections 12.21 and 12.31 
one can prove soundness and completeness, using (a modified version of) Tardos' proof construction. Note 
that, since this proof method uses several non-tight bounds, it is very well possible that there exist sets of 
parameters that do not satisfy these conditions, but still guarantee soundness and completeness. So if the 
conditions are not satisfied, we can only conclude that the proof method does not work in that case. 

2.2 Results for the asymmetric Tardos scheme 

In the original Tardos scheme, and in several papers discussing the Tardos scheme, the score function 
is asymmetric in yi, as only the positions with y, = 1 are taken into account for the accusations. The 
construction of this asymmetric Tardos scheme is the same as in Subsection l2.ll but with the scores from 
d2J replaced by: 



+y /(l-Pi)/Pi ifXjt = l, yi = l, 
Sji={-y/Pi/6--Pi) ifX / , = 0,y i =l, (3) 

otherwise. 

Blayer and Tassa performed an extensive analysis of this scheme in [ 2 1 , and showed that under the following 
assumptions, one can prove soundness and completeness for given c and 77 . In these Theorems, the function 
hT x : (0,°o) — ¥ (5,°°) is defined by h~ l (x) = (e x — 1 — x)/x 2 , while the function h : (j,°°) — > (0,°°) denotes 
its inverse function as in J2] , so that e x < 1 + x + Ax 2 for all x < h ( X ) . 

Theorem 1. fi2\ Theorem 1.1] Let the Tardos scheme be constructed as in Subsection \2.1\ but with the 
asymmetric score function from (0. Let d a ,r be positive constants, with r > A, such that df>,d z ,dg,d a and 
r satisfy the following two requirements: 



da> T f^, (SI) 
h{r)y/c 

d-7 rdt , ,„„ N 

-T--^>1- (S2) 



Then the scheme is £\ -sound. 

Theorem 2. fi2\ Theorem 1.2] Let the Tardos scheme be constructed as in Subsection \2.1\ but with the 
asymmetric score function from (0. Let s,g be positive constants such that dj>,d z ,dg,S and g satisfy the 
following two requirements: 



l ~T s h-\s)s 



>g, (CD 



K y/dgc 

gd t -d z >r\\\^-. (C2) 



Then the scheme is Ej-complete. 



Tardos' original choice of parameters was the following, which allowed him to prove his scheme is 
£i -sound and £2-complete for all c > 2 and tj < t/c/4 J8] Theorems 1 and 2]: 

<^ = 100, d z = 20 7 d s = 300, d a = 10, r=l, s=l, g = -. 

Blayer and Tassa proved that to achieve E\ -soundness and £2-completeness for all c > 2 and TJ < 1, the 
following choice of parameters is also provably secure [2, Section 2.4]: 

^ = 85, d z =\5, d s =W, d a = 8, r = 0.611, 5 = 0.757, g = 0.2461. 

In ||7] Corollary 1], Skoric et al. showed that the following choice of parameters suffices to prove soundness 
and completeness for asymptotically large c: 

? 1 

d(— > An , d,-^47t, afg— >°o, d a ^-2n, r=l, s = h(l), g^-—. 

% 

According to the Central Limit Theorem, the scores of innocent users and the total score of the coalition 
converge to certain normal distributions. Under the assumption that the scores behave exactly like these 
normal distributions, Skoric et al. showed in |7, Corollary 3] that the following choice of parameters is then 
sufficient and necessary to prove soundness and completeness: 

d( — > 2% , d z — > 2k, dg — ¥ °°. 

Applying the analysis from Section [6] to the asymmetric Tardos scheme, we can prove that the following 
choice of parameters is provably sufficient for large co 

2 1 1 

de^27t, d,^27t, dg^- 00 , d a — > %, r->-, s— >-°°, g^t —. 

2 n 

So with Blayer and Tassa's proof construction, we obtain a 2 times shorter asymptotic codelength compared 
to the shortest provable codelength of Skoric et al. for the asymmetric Tardos scheme, and we achieve the 
asymptotic optimal codelength for the asymmetric Tardos scheme which Skoric et al. only achieved when 
they added the assumption that scores behave like normal distributions. 

2.3 Results for the symmetric Tardos scheme 

We will prove in Sections[3]and|4]that with the following assumptions on the parameters, we can also prove 
soundness and completeness for the symmetric Tardos scheme. 



Theorem 3. Let the Tardos scheme be constructed as in Subsection \2.1\ and let d a ,r be positive constants, 
with r > 2> such that de,d z ,dg,d a and r satisfy the requirements from (IS 1 b and dS2t . Then the scheme is 
£\ -sound. 



2 These results can be obtained by applying the analysis from Section|6]to Blayer and Tassa's original analysis for the asymmetric 
Tardos scheme. The main difference is that then one needs g = — +o(l) instead of g = — +o(l), which causes an extra factor 4 for 
dt and extra factors 2 for d z and d a . 



Theorem 4. Let the Tardos scheme be constructed as in Subsection \2.1\ and let s,g be positive constants, 
such that d£,d z ,dg,S and g satisfy (1C21 I and the following requirement: 




(CD 



Then the scheme is Ej-complete. 



Using the above results, in SectionQwe will prove £1 -soundness and £2-completeness for all c > 2 and 
tj < 1 for the following set of parameters: 

^ = 23.79, ^ = 8.06, d 5 = 28.31, rf« = 4.58, r = 0.67, s=1.07, g = 0.49. 

This improves upon the constants from Blayer and Tassa by a factor more than 3.5, and it improves upon 
the original Tardos scheme by a factor more than 4. Furthermore, for bigger c and smaller tj the values of 
d( further decrease, easily leading to a factor 10 improvement over the original Tardos scheme. 

Skoric et al. showed that for asymptotically large c, the following set of parameters is sufficient for 
proving soundness and completeness in the symmetric Tardos scheme [6, Corollary 1]: 

2 
d£—>7t, d?—* 2n, dg —> °°, d a — » n, r = 1, s = h(l), g —*■ — . 

With the added assumption that the scores of innocent users and the joint score of guilty users are normally 
distributed, Skoric et al. also showed that the following set of parameters is sufficient for soundness and 
completeness, for asymptotically large c |6, Corollary 2]: 

, K 2 

dt—t—, d z —^n, dg—>°°. 



Since by the Central Limit Theorem these scores will also converge to normal distributions, this shows that 
the asymptotic optimal codelength for the symmetric Tardos scheme is £ = (4- +o(l))c 2 ln(«/ei). We 
show in Section [6] that for asymptotically large c, we can actually prove soundness and completeness for 
this optimal codelength, without any added assumptions. In the asymptotic case of c — > °°, our construction 
gives the following parameters: 

%1 j i % 1 2 

at ->-=-, d z -*7t, d s ^°°, d a ^-, r4-, i^°o, g->-. 

2 11% 

Similar to the asymmetric case, we thus get a factor 2 improvement over Skoric et al.'s best provable 
asymptotic codelength, and we achieve the asymptotic optimal codelength which Skoric et al. only proved 
with the added assumption that the scores behave like normal distributions. This also improves upon 
results from Nuida et al. in (5), who showed that with certain discrete distribution functions F, one can 
prove soundness and completeness for £ rss 5.35c 2 ln(n/ei) for large c. With our construction, we show a 
codelength of £ s=s 4.93c 2 ln(n/ei) is provably secure for large c. 

3 Soundness 

Here we will prove Theorem[3] i.e. prove the soundness property from DefinitionQ"! under the assumptions 
(1SU and ( !S2t . We will closely follow the proof of soundness of Blayer and Tassa of [2, Theorem 1.1]. We 
will first prove an upper bound on E [e aS i~\ , with a = \/(d a c) and using only ( ISU . and then use this result 
together with ( lS21 i to prove upper bounds on P[j G o(y)] for innocent users j, and P[a(p(X)) % C]. 

Lemma 1. Let d a and r be positive constants, with r > j> such that dg,d a and r satisfy Equation ( IS 11 1. 
Let j be an innocent user, and let Sj be the user's score in the Tardos scheme from Subsection \2.1\ Let 
a = \/(d a c). Then 

E,, x ,p[e aS ']<e +ral1 . (4) 



Proof. First we fill in Sj = Y?i=i Sjt and use that Sj does not depend on Xjn for / ^ j to get 



E9*A' aSi ]= E tfjj, 



n< 



aSji 



tl E y^ji,Pi [ e 



as a 



Since Sh < \/l/5 = V^S it follows that aSy, < ^/dg/{d a ^/c). From (IS lb we know that \fd$ / (d a y/c) < 
ft(r) for our choice of r, hence aS« < h(r). From the definition of h we know that e x < 1 + x + rx 2 exactly 
when x < h(r). Using this with x = aSji we get 

E [«"%] < £ [l + a5 / , + r(a5 /( -) 2 ] = 1 + aE[fy] + m 2 £$ ( -]. 

We can easily calculate E[S/f] and 2?[jSjJ, as y* and Xjj are independent for innocent users j. As in fl6j 
Lemmas 2 and 3], we obtain 

E[Sji}=0, E[S 2 } ^ = \. (5) 

So it follows that E [e aS fi] < 1 + ra 2 < e ra ~, and £^3 [e aS j] < e ra t , which was to be proven. □ 

Theorem\3\ We prove that the probability of accusing any particular innocent user is at most £\/n. Since 
there are at most n innocent users, the probability of not accusing any innocent users is then at least 
(1 — £\/n)" > 1 — £i, which then proves the scheme is £\ -sound. 

Since a user is accused if and only if his score Sj exceeds Z, we need to prove that P[Sj > Z] < E\/n 
for innocent users j. First of all, we write a = \/(d a c), and we use the Markov inequality and Lemma[T] 
to obtain 



P[j € <r{y)] = P[Sj >Z]=P [e aS J > e aZ ] < e - aZ E [e aS j] < e -« z +^'. 

Since we want to prove that P[j S o(y)] < £\ /n, the proof would be complete if e - aZ + ra <■ < e ~ k < g t / / ra> 
i.e. if —aZ + ra 2 £ < —k. Filling in a = l/(d a c),Z = d z ck and t — d(C 2 k, and dividing both sides by —k, 
we get 

da d a 



This is exactly inequality ( IS2I ), which was assumed to hold. This completes the proof. 



□ 



Compared to the original proof in [2|, this proof has barely changed. The only difference is that now 
the scores are counted for all positions i, instead of only those positions where yi = 1 . However, since in 
the proof in [2] this number of positions was bounded by I, the result remains the same. This explains why 
we can prove £i -soundness with the symmetric score function under the same assumptions (IS lb , JS2b as 
in 0. 



4 Completeness 

For the proof of Theorem |4j we will again closely follow the proof of Blayer and Tassa of |2, Theorem 
1.2], and make changes where necessary to incorporate the symbol- symmetric score function. We first give 
a Lemma to bound the expectation value of £V,x,/"J [ e ] w i tn P = s Vd/c and S = L;<sc^j' an ^ then use 
this Lemma to prove completeness. 

Lemma 2. Let s and g be positive constants such that d$,s and g satisfy (ICl'l l. Let j3 = s\/o/c, let C be a 
coalition of size c, and let S = Y^jec^j be their total coalition score in the Tardos scheme from Subsection 
IZT] Then 



Ey.X,p 



.-PS 



< e-zP 



(6) 



The proof of Lemma [2] is quite lengthy and can be found in Appendix FBI Using this Lemma we can 
easily prove Theorem|4] 

Theorem\4\ We will prove that for a coalition of size c, with probability at least 1 — £2 the algorithm will 
accuse at least one of the colluders. Note that if no colluders are accused, then the score of each colluder 
is below Z. Hence if the total coalition score S exceeds cZ, then at least one of the pirates is accused. So to 
prove £2-soundness, it suffices to prove that P[S < cZ] < £2. 

We first use the Markov inequality and Lemma [2] with j3 = s\fd/c > to get 



P[a(y) nC = ®}<P[S<cZ}=P 



-ps 



>. 



-PcZ 



< 



oP cZ E~ v ~ 
y,x,p 



-ps 



< 



Jcz-gpe 



Since we want to prove that P [S < cZ] <e ^ k < (£ 1 /«) T ' = g 2 , the proof would be complete if j3 cZ 
—r\k. Filling in j3 = svS/c,£ — d(C 2 k,Z — d z ck, 5 = l/(dgc) and writing out both sides, we get 



■gfit< 



gdi-d z >i}\ 
This is exactly inequality dC2l . which was assumed to hold. This completes the proof. 



D 



Compared to 0, we see that instead of using (IC 1 1 . we now need that inequality dCl't holds. Comparing 
these two inequalities, we see that a term ^ has changed to a -|, and a term ^p_ has changed to a -£-=. The 

most important change is the i changing to a |, since that term is the most dominant factor (and the only 
positive term) on the left hand side of ( ICl't . By increasing this by a factor 2, we get that g < j± instead 
of g < i Especially for large c, this will play an important role, and it will basically be the reason why 
the required codelength can then be reduced by a factor 4, compared to Blayer and Tassa's analysis for the 
asymmetric scheme. 

While the other change (the -j^ changing to -j-^) does not have a big impact on the optimal choice of 
parameters for large c, this change does influence the required codelength for smaller c. Because of this 
change, we now subtract more from the left hand side of dCl't . so that the value of g is bounded sharper 
from above. This means that for finite c we cannot reduce the codelength of Blayer and Tassa by a factor 
4, but only by a factor slightly less than 4. 

Finally, after using dCll in the proof above, the analysis remained the same as in [2 j. So under the 
same assumption dC21 i as in [2], we could also complete the proof for the symmetric Tardos scheme. 



5 Optimization 

Similar to the analysis done by Blayer and Tassa in J3] Section 2.4], we also investigate the optimal choice 
of parameters such that all requirements are satisfied, and dt is minimized. As only one of the inequalities 
has changed, and it changed only on two positions, the formulas for the optimal values of dg,d a ,d z ,d(< in 
the following Theorem are almost the same as in [2, Section 2.4.5]. We do not give a proof here, as it would 
be nearly identical to the analysis done in J21 Section 2.4]. 

Theorem 5. Let rj,c be given, and let r,s,g be fixed, satisfying r € (j, 00 ),^ € (0,°°),g £ (0, -). Then the 
optimal choice ofdg,d a ,d z ,d£, minimizing di and satisfying conditions dSU , dS2l ), dCl'l ),( IC2l , is given by: 

1 / l(h~ 1 (s)s) 2 16/2 \~ fc-^AN 



d S = 



.1-2* 



% \ % 



d a = max 



h(r)y/c' g \ 




d 7 = 



gdi 



rr]< 



(01) 



(02) 



(03) 



d, 



(04) 



So to find the optimal septuple (f,s,g,dg,d a ,d z ,dg) for given c,r), satisfying all requirements and 
minimizing^, one only has to find the triple (r,s,g) withr € (j,°°),s <E (0,°°) andge (0, |) that minimizes 
the right hand side of ( 1Q41 i. 



Example An optimal solution to ( IS ll l.( IS2l i.( ICl ' b .( IC2b for c > 2 and 77 = 1, minimizing d(, is given by 

d £ = 23.79, d, = 8.06, d 5 =28.31, d«=4.58, r = 0.67, s = 1.07, g = 0.49. 

This means that with these constants, we can prove soundness and completeness for all c > 2 and 77 < 
1, with a codelength of I = 23.79c 2 ln(n/ei). Compared to the original Tardos scheme, which had a 
codelength of £ = 100c |~ln(n/£i)~|, this gives an improvement of a factor more than 4. Furthermore we 
can prove that this scheme is £\ -sound and £2-complete for any value of c > 2 and 77 < 1, while Tardos' 
original proof only works for c > 2 and r\ < y/c/4. 

Example In practice, one usually has 77 -C 1 instead of 77 = 1 . For example, it could be that £2 = 1/2 is 
sufficient, while E\ = 10~ 3 is desired and there are n — 10 6 users, so that r\ sa 0.033. Then the optimizations 
give us d( f=a 10.89 for c — 2. So with this larger value of £2, a codelength of I = 10.89c 2 ln(n/£i) is 
sufficient to prove the soundness and completeness properties for any c > 2. This is then already a factor 
more than 9 improvement compared to the original Tardos scheme. 

If we let c increase in inequalities ( IQll ). (l02l i. (l03b ,( l041 i. i.e. if we only want provable soundness and 
completeness for c> cq for some cq > 2, then one can easily see that the inequalities become weaker and 



1 




500 1000 



Figure 1: Optimal values of d(, for several values of c between 2 and 1000. The different lines correspond to the cases 
77 = 1,0.5,0.2,0.1,0.01 respectively, where higher values of 77 correspond to higher values of d(. 

an even shorter codelength can be achieved. FigureQ]shows the optimal values of d( against different values 



^ = ^(l-3j^r(i -<'(D) h 1 \ («) 



of c, for several values of 77 . One can see that for large c, a codelength of C < 6c 2 ln(n/ei ) can be sufficient. 

2 
In the next Section, we will see that for large c, the optimal values of di will converge to \ sa 4.93. 

6 Asymptotics 

Here we show that with the symmetric Tardos construction, for c — > °° we can prove soundness and com- 
pleteness for di > = K- + O (c~ '' 3 ) . We calculate the optimal first order error term explicitly, and also show 
explicitly the dependence on rj, as the choice of rj may depend on the particular application. Note that at 
least tj < 1, but it may be considerably smaller and it may depend on c as well. 

Theorem 6. Let 7= (jt) ~ 0.35577. The optimal asymptotic (for c — >■ °°) value for dg, and the accom- 
panying values for d z ,dg, are 

de = T ( : + ( 37+ 187 ioi^ (1 +o(1)) ) c_1/3 ) ' (7) 

dz = n ( l + (h +6r \^~c {l +o(1)) ) c_1/3 ) ' (8) 

and the choices for g, r, s leading to them are given by 

, = l(i-(I y+ 3 y i(i +0 (i)))c-^), do) 

r=\U+ ( 2 7-67j^(l + *(!))) c-'A , (11) 

S = 10S (^^ 1+0(1))C1/3 )- (12) 

We have optimized for dg, and one could get slightly better error terms for d z or d$. For example, 
optimizing for d z yields an optimal value of n(\ + (3/ + 9y f 5^7(1 + o(1)))c~'' 3 ), for a suboptimal dp of 

£(1 + (4/+ 15/^(1 +o(l)))c- 1 / 3 ), where / = 2~ 1 / 3 y. 

It is remarkable that the error terms for d{, and d z scale with c -1 ' 3 , while Skoric et al. found error terms 
scaling withe -1 ' 2 . It turns out that in [6| an error term in fj, was not taken into account, and if one does do, 
their analysis for the binary case will also yield error terms scaling with c -1 ' 3 . Also note that dg (related 
to the cutoff) scales with c 1 ' 3 , i.e. the cutoff -J— scales with c~ 4 ' 3 rather than with c _1 as one might have 

d s c & 

guessed. 

An immediate consequence of Theorem|6]is the following result, which shows that asymptotically we 
will achieve codelengths of £ sa 4.93c 2 ln(n/£i), i- e - codelengths that are about 4.93% of Tardos' original 
codelengths. 

Corollary 1. For c — > °° the above construction gives an £\ -sound and £2-complete scheme with parameters 

£-> yc 2 ln(n/ei), Z-> %c\n{n/e{), d^^c^ 3 . 

This proves that our analysis is asymptotically tight, since for large c we achieve the optimal codelength 
oi£=(^+o(l))c 2 ]n(n/e 1 ). 

Remark In the proof of Theorem[6l we use that r can be taken in the neighborhood of A to get the final 
result, dig = \ +<9(c~'' 3 ). In [6| however, no such variable r was used, as it was simply fixed at 1. If they 
had taken r as a parameter in their analysis and had taken it close to A in the asymptotic case, then they 
would have obtained the same asymptotic results as we did above, but still with different first order terms. 
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A Integral codelengths 

One detail we have not taken care of and which is often "swept under the carpet" in other literature, is that the 
codelength £ by definition has to be integral. In the construction of the Tardos scheme however, we said we take 
£ = d{C ln(n/ei), while ln(n/£] ) andd( may not be integral. To solve the problem of non-integral codelengths, Tardos 
rounded up ln(n/ei) and took d( = 100 in his original scheme. Blayer and Tassa also rounded up ln(n/£i) and took 
<j?£ = 85, presumably also to guarantee that I is integrajj. However, rounding up di and ln(n/£i) could drastically in- 
crease the codelength. For example, suppose n = 10 6 , £\ = £2 = 0.01, and c = 25. Then r\ = 0.25 and ln(n/£i ) ~ 18.42, 
and numerical optimizations give di ~ 8.18. Without rounding we would get a codelength of I ~ 94155, while with 
rounding we get (! = 106875. So then the codelength £' is more than 13.5% higher than £, only because we rounded 
up both ln(n/£i ) and d(. 

Instead of rounding up inbetween, rounding up the entire codelength to (! = \d(C 2 ln(n/ei)] makes more sense. 
The codelength is then increased by less than 1 symbol, so we hardly notice the difference in the codelength. However, 
the proofs we give in Section|3]and|4]are based on £ = die ln(rc/£i), which corresponds to using d( = £/(c \a{n/e\)). 
If we take £' = \£~] , then we get d' e = \i] j(c 2 ln(n/e\ )) > df, (for I ^ N), so that with the same parameters Z and 8 we 
may not be able to prove soundness and completeness anymore. In particular, equation dS2t might not be satisfied if d( 
is increased, since JS2t > implies that Ard( < d 2 . Increasing the left hand side may violate this bound, if we do not also 
increase d z . 

The following Theorem takes care of this minor problem, by showing that if we can find a solution to dSlt . dS2t . 
dd't . dC2t with a fractional codelength £, then we can also find a solution to these inequalities with the integral 
codelength \f\ . In particular, we show which scheme parameters £ , Z and S one could take to achieve this result. 

Theorem 7. Let the Tardos scheme be constructed as in Subsection \2.1\ and let (d£,d z ,dg,d a ,r,s,g) be a septuple 
satisfying conditions dSlt , dS2l l, dCl't , dC2b giving scheme parameters £q = d(C ln(n/£\),Zo = d z c\n{n/£\) and Sq = 
l/(dgc). Then the Tardos scheme from Subsection \2.1\ with parameters 

£=\£a\, Z = Zo + ^{\lo]-£o), § = So, (13) 

is Ei-sound and £2-complete. 
Proof Let us write CO = d((\lo] —£q)/£o- We prove that if the equations hold for (de,d z ,d§,da,r,s,g), then they also 



hold for (d' e ,d' z ,d s ,d' a ,r,s,g), where d' ( = d ( + C0,d' z = d z +gco,d' a = (d' z + J (d' z ) 2 -4rd' e )/2. Since for this set of 

parameters we get £,Z and 8 as in d!3t . the result then follows. 

First note that since d§ , s and g did not change, both sides of inequality dCl'b remain the same and this inequality is 
still satisfied. For inequality dC2t . note that both sides also remained the same, since gd' e — d z =g(d( + Co) — (d z + ga) = 
gd( — d z . For dS2t . we rewrite this inequality as a quadratic inequality in d' a : 

(d' a ) 2 + (-d' z )d' a + rd' t <0. (14) 

This inequality is satisfied if and only if d' a lies between the two roots of x 2 + (—d' z )x + rd' e = 0, which therefore must 
exist. These roots exist if and only if (d' z ) 2 — Ard'^ > 0. Since we know that d 2 — 4rd( > the inequality follows if 

(4) 2 - Ard[ = (d 2 - Ardi) + (2gd z + g 2 m 2 - Ar) > d\ - Ard e > 0. 

From l[S2]l and JC2\ we know that g(d z ) > g{Ard() > Ard z , i.e. gd z > Ar. So it follows that 2gd z +g 2 C0 2 > Ar, which 
proves the second inequality. The third inequality then follows from JS2b . 

Finally for dSlt , we prove that d' a >d a , while the right hand side remains the same, so that this inequality is still 
satisfied. Note that d a is also at most the largest root of (14) , so d' a — d a is bounded by 

d z + ] /(dQ 2 -Ard> d z + ^/d 2 -Ard e 

dr, —dry > " " > > 0. 

a a - 2 2 ~ 2 ~ 

Here the second inequality follows from earlier calculations that (d' z ) 2 — Ard' e >d 2 — Ardf. So this choice of d' a is at 
least as high as d a , so inequality dSlb is satisfied. This completes the proof. D 



3 Numerical optimizations show that even a parameter set with d/ « 81.25 exists that satisfies all requirements of Blayer and Tassa. 
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B Proof of Lemma |2] 



For proving Lemma|2]we will again closely follow the analysis of Blayer and Tassa, and make changes where necessary. 
First, we write the total accusation sum of all colluders together as follows: 



s=ii sji = i> Urn - c —^) +f a - yi , 

i=l jgC i=\ V 1i / i=\ 



q> 



Mm 



Here x, is the number of ones on the fth positions of all colluders, y,- is the output symbol of the pirates on position 
i, and we introduced the notation q/ = v/(l — Pi)/ Pi. Following the analysis from e.g. Blayer and Tassa, and Tardos, 

but using that 5/ = ( 1 — >',) ( ^-^ — x,qi J for posit 
function), we can bound the expectation value by 



but using that Si = (1 — >',) ( ^r^ — xiqi ) for positions i where y; = (instead of 5; = 0, as with the asymmetric score 



where 



*«Ms(t(;>< 



E\ rX ifx = c, 

max(£'o.j:,£ , i„ v ) otherwise, 



(15) 



and, for some random variable p distributed according to F 

E(),x = E p 
Ei, x =E P 



fii-pr-e-^-*) 



^(i-prvX*-*? 



Now, using B = sv8/c, we bound the exponents in Eq x and E\r as follows. 

-Be n n ( c-x\ Be Be 
s=-^<-Bcq<-B[xq )<^-< J j==s. 

v§ V q J q vs 

So |/3 (xq — {c — x) /q) | < s f or our choice of B . So we can use the inequality e w < 1 + w + h~ ' (s)w which holds for 
all w < s, with w = ±/3 (xq — (c — x)/q), to obtain 



Eo.x < E p 



p x {\-p) c - x [\ + B[xq 



+ h-\ S )B 2 [xq 



p X (i-p) C - X 1-/3 [xq 



+ h- x (s)B 2 [xq 



Introducing more notation, this can be rewritten to 

£(U < F (Kx + BF 1>X + h- ' (s)B 2 F 2 ^ 
E U < F , x -BF lr x + h- 1 (s)B 2 F 2 j C , 
where 

Fos=E p [f(l-p)<>-*\, 



El. 



E 2 , 



p x (l- P r- x (xq 



P *{\- P y- x [x q - 



We first calculate F\ a explicitly. Writing out the expectation value and using the definition of f(p) from (T), we get 



F U 



wr^-^s-s) 



dp 
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The primitive of the integrand is given by l(p) = p x (\ — p) c x , so we get 

/(l - S) -1(8) (i - sys c - x - g- r (l - 8) c 
F ^~ a -46' ' 
For < x < c, we bound Fi, from above and below as 

-5 x (l-5) c - x 
71-48' 
Using these bounds for M x , with < x < c, we get 



<F lx < 



7V -48' 



(i-sys c 

ti-48' 



(16) 



71 — 40 

Since 8 < I — 8, the maximum of the two terms is the first term when < x < c/2, and it is the second term when 
c/2 < x < c. Note that this bound is different from the one of Blayer and Tassa, since in their analysis they do not have 
this maximum over two terms, but just the first of these two terms. We cannot prove the same upper bound as Blayer 
and Tassa, and therefore our bound for M x ,0 < x < c, is slightly weaker than Blayer and Tassa's. 

For the positions where the marking assumption applies, i.e. x = and x = c, we do not use the bounds on F\^ x , but 
use the exact formula from d 16b to obtain 



Mo<Fo.o-j3 
M c <F 0>c -j8 



■+h- l ( S )l3 2 F2 : Q, 



71-48' 



The value of M c is the same as that of Blayer and Tassa, but whereas Blayer and Tassa had Mo = Fq, we get a lower 
upper bound on Mq. This is essentially the reason why with the symmetric score function we get shorter codelengths 
than Blayer and Tassa. 

Substituting the bounds on M x in the summation over M x from J 15b gives us 



x=0 



c-\ 



£( M v <M +M c +£ 



v-l 



M x 



< [F0.0-P 



F ,c-P 



(i-8) c -8 c 
71-48' 



(sWF 2fi 



'^ C - §C ,H-\,)^ 



I 

.1=1 



n-48' 



,v=L C /2j + l 

Gathering all terms with Fq x and Fi x , and using the substitution x' = c — X for the summation over [c/2] — 1 terms, 
we get 



t(;)^t(;K-^ + rwt(;K. 



P 



71-48 



^48'\ 6C+ ^U SX{l - 3r " 



P 



71-48' 



i=\ 

r^/21-1 . 



(17) 



For the summation over F2. x , let us define a sequence of random variables {7)}^ =1 according to 7) = q with probability 
p and 7) = — \jq with probability 1 —p. Similar to the inequalities from (|5j, we get that E p \T\\ — and E p [T?\ — 1. 
Also, since T, and T; are independent for ( 7^ j, we have that E p [TjTj] — for i 7^ j. Therefore we can write 



!=1 



'=1 ¥j 
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But writing out the definition of the expected value, we see that the left hand side is actually the same as the summation 
over F2.X, so that we get 






^L(> v (i- P r*K 



£(>- 



Also we trivially have that 



LdW-p) 



For the summation over [ C /2J terms we use the following upper bound, which then also holds for the summation over 
\c/2] — 1 terms: 

8 C + £ ( c *) «5 V (1 - 5) c - x < £ ( c ^ 8 x (l - 8)°-* = 1 - (1 - 8) c < 5c. 



.v=i 



x=\ 



Note that this first inequality is quite sharp. In most cases S <ti 1 — 8, so that the summation is dominated by the terms 
with low values of x. Adding the terms with [_c/2\ < x < c (i.e. terms with high powers of 8) to the summation has an 
almost negligible effect on the value of the summation. 

Now applying the previous results to J17t . and using (1 — 8) c > 1 — 8c, which holds for all c, we get 



i(;)^<i-/^+*-w c . 



K-A8 1 



We want to prove that, for some g > 0, 



±Q Mx <l-P^^+h- l (s)P 2 c<l-gP<e-^ 



tc-45' 



(18) 



Filling in /3 = sv8/c and 8 = l/(d§c) and writing out the second inequality, this leads to the requirement that 

2-£ h~ l {s)s^_ 



K 



IdTc 



This is exactly inequality dCl'l ). which is assumed to hold. Combining the results from Equations dl8t and (TTJ gives 
us 



%«[«-i^(t(:)«.)'^- rf ' 



This completes the proof. 



□ 



C Proof of Theorem © 

We introduce parameters K g ,K r ,K s ,a priori depending on c, to enable us to write 

g=l-K g C-V\ h(r)=K r c-^, —L_=K S C~^. 

K Stl ' (S) 

Clearly K g ,K r ,K s are positive, and we will assume that K g and K r are 0(1) for c — > °°. This assumption will be 
validated later on. Note that we do not demand this for K s (and indeed, it will turn out that K s — > 00). 

Note that r = hT x (K r c^ 1 ^) = \ + \K r c~ X ^ + 0(f -2 / 3 ), so that, with for convenience R = £, we have 



«-! + (^+n*)^ +0 (^) 



(19) 



14 



Next, for convenience we put D = \/ -r, and then we have from (01) that D = Dqc l '^ , where 



1 I / 16 ~ 



A) = ^rrr I 1 + \l 1 + —K g K} 



Note that Dq is a decreasing function of A",, with limiting value -?= — J= 



From (02) we see that d a — max I -rrr,Xg >, where xq = R+ J R 2 + RDj . Note that 

x Q = 2R+^D^ + o(c- 2 ^, (20) 

where we used that j = o(l). Note that (03) and (04) imply d(, = °, , a _ R f , and that by rf a > R we have rf( > — ^— — -, 

with equality if and only if d a = xq ■ So in order to minimize d[ we minimize - — - — - , and show that there is a solution 
to this with d a — xq, which then must be the optimum. For this optimal solution, by dl9t and d20t we get 

2 3 2 

d f = ^- +L c-^ 3 + 0(c- 2 ^), whereL = ^ r K g + —K r + nDo-. (21) 

2 2 6s 

To find the main terms in the optimal values for d( , d, , dg , for the moment we neglect error terms. The fact that d a = xq 

implies that -JjK < xq, and this is asymptotically equivalent to ip < 5. This can be expanded into 1 + J 1 + ^-K g K 2 < 

g K r K s , and this leads to {k^K^I 



7lK g K r K s , and this leads to {n i K l ,K 2 — 16)A", > 2n 2 K r , which actually is two conditions 



,2 



16 „.,--- 2K 2 K r 



K g K$ >^r= 0.51602 . . . , K s > -= =-i . (22) 

This shows that it is impossible to choose both K g and K r close to 0, and that it is certainly possible to choose them 
0(1) as c — > oo. Note that optimizing 3. implies taking s as large as possible, but this means taking K s as small as 
possible, which is limited by the above condition. Indeed, in minimizing Lo we would like to minimize K g and K r , 
leading to growing K s , while also s preferably keeps growing. We will see that this is possible. 

In optimizing Lo, to find the main term we also neglect for the moment the term tzDq^, as it also tends to 0. So 
we optimize L' Q = \K g + \K r under the constraint K^K 2 > i§. The minimal value for L is reached for K g — > % ~ 
0.11325, K r -^ 6y = 2.1346, where y = (j^) 2 ^ 3 ~ 0.35577 is a convenience constant. In this case K g K 2 -t ^, so 
K s ->• «., and D -* 77=^= -> 3rcy« 3.3531. It follows thatL Q -> ^-y- 5.2670. 

Let us next be more careful, and not throw away the term TZDq-L and the error terms. Lo as in d21t is a priori a 
function of K g ,K r and s. We can take for A", its exact optimal value according to {22}, viz. 

Ks = llzl f (23 ) 

n 3 K g K 2 - 16 

so that Do = f A" r . Note that d23b allows us to eliminate from Lo the variable K,,. This yields 

K 2 f f]\ 9 1 1 

We now minimize Lq by setting the partial derivatives w.r.t. s and K r to 0. Indeed, -Jjr = 4" (1 + 3^) — JT ■jtj; — 



16-^j, and this being implies 



l +3 IW 2 -16-l = ;r 2 -L. (24) 



Further, by ^^ = _ (^'K+' c -i/3 we find 3u = _^ Kr + ^ MK+V 1 ^, and mis being Q impUes 

«« = l((5-l)«' + l)e- 1 / 3 . (25) 

From d24t and d25b we eliminate A" r , and thus obtain an equation in s only, viz. 
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The first term on the left hand side is (^) 3//2 (l + 0(\)), and the right hand side is ^1/2 (1+0(7)), and as ^ < J 

and .s — > 00 the right hand side clearly is smaller, so vanishes in the 0(|). So we find (7J- ) 3 ' 2 (1 + 0(7)) = S e 1 ' 2 , 
and this yields 



n 2 y \logcj) C 



In turn this implies 



and 



^Ilogc-loglogc+logrj + Od), 7 = ^(l + o(^gf)), (26) 

^=§ log2c ( 1+0 (i))' (27) 

Indeed we find that K s and i both tend to 00. 

To get the proper value for K r we turn to l !24t . and introduce 6 such that K r = 6y+ 6, so that 6 will tend to 0. Then 
J24b becomes a cubic equation in 6: 

e 3 + 18ye 2 +( 108^-7 %^—)o+[^^t- , 36 L I =0. (28) 

v (!+ 3 7)^; v i+3 t (1+3^)^; 

When i' — s> 00 and Aj — > 00, this ultimately becomes 6(6 2 + 18y0 + 108y 2 ) = 0, with the quadratic term being positive 
definite, showing that l !28t for finite large s has exactly one real solution, which will be close to 0. For this solution we 
have, using l !26t . | |27| |. 

i ^ +o (ii)) 6+o(8l »-fK i+o (i 

hence 

-?H(i)))' <--iH(»°(± 

Putting everything together, using J26t . we find 



^0 = ^ 2 y(^l + 6r,^-(l+ o (l)) 
The result now easily follows. □ 

References 

[1] E. Amiri and G. Tardos, "High Rate Fingerprinting Codes and the Fingerprinting Capacity,", Proc. 20th ACM- 
SIAM Symp. on Discrete Algorithms, pp. 336-345, 2009. 

[2] O. Blayer and T Tassa, "Improved Versions of Tardos' Fingerprinting Scheme," Des. Codes Cryptogr., vol. 48, no. 
1, pp. 79-103, 2008. 

[3] Y. Huang and P. Moulin, "Saddle-Point Solution of the Fingerprinting Capacity Game Under the Marking As- 
sumption," Proc. 2009 IEEE Int. Symp. Information Theory, vol. 4, pp. 2256-2260, 2009. 

[4] T Laarhoven, "Collusion-Resistant Traitor Tracing Schemes," M.Sc. thesis, Dept. Math. Comp. Sc, Eindhoven 
Univ. Techn., Eindhoven, The Netherlands, 2011. 

[5] K. Nuida et ah, "An Improvement of Discrete Tardos Fingerprinting Codes," Des. Codes Cryptogr, vol. 52, no. 3, 

pp. 339-362, 2009. 
[6] B. Skoric et al, "Symmetric Tardos Fingerprinting Codes for Arbitrary Alphabet Sizes," Des. Codes Cryptogr, 

vol. 46, no. 2, pp. 137-166, 2008. 

[7] B. Skoric et al, "Tardos Fingerprinting is Better Than We Thought," IEEE Trans. Inform. Theory, vol. 54, no. 8, 
pp. 3663-3676, 2008. 

[8] G. Tardos, "Optimal Probabilistic Fingerprint Codes," Proc. 35th ACM Symp. on Theory of Computing, 2003, pp. 
116-125. 



16 



